#disable
decoder-events,dns-events,http-events,smtp-events,stream-events,tls-events
#custom
1:2003254-1:2003281 #ET MALWARE SOCKSv5 Inbound Request
1:2003492 #ET MALWARE Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
1:2007994 #ET MALWARE Suspicious User-Agent (1 space)
1:2001891 #ET USER_AGENTS Suspicious User Agent (agent)
1:2003626 #ET MALWARE Double User-Agent (User-Agent User-Agent)